Thunderbird 154 closes the same sandbox hole as Firefox

Thunderbird is the inbox that stays open: invoices, the school thread, the shop mailbox. On 18 August 2026 Mozilla shipped Thunderbird 154 and closed the same high sandbox hole they closed in Firefox 154. A sandbox is the fence around code that should not reach the rest of the app. Mozilla is explicit this is not an open-one-message-and-the-PC-is-owned bug: scripting is disabled when you read mail, so the risk sits in browser-like corners of Thunderbird, not in a normal inbox click. Updating Firefox does not patch Thunderbird: they share guts, not the installer. Open Help, then About Thunderbird, wait until the number reads 154, and Restart.

Overview

What broke

Mozilla’s Thunderbird 154 advisory, MFSA 2026-78, leads with CVE-2026-75874: a sandbox escape in the Remote Settings Client. The reporter is crixer. Mozilla rated it high. It is the same hole Firefox 154 closed in MFSA 2026-74. Remote Settings is how Thunderbird fetches settings, blocklists, and other configuration from Mozilla. A sandbox is the cage around untrusted code. An escape means that code can walk out into the rest of the app.

Mozilla puts a caveat on the whole Thunderbird bulletin, and it matters: “In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.” Read that as: a normal message in the reading pane is not a Firefox tab. Do not treat this as email remote code execution. Do treat it as a real hole in the engine Thunderbird uses when it behaves like a browser.

The same 154 restart also stacks other high bugs: a site isolation hole in WebGL, privilege escalation in DOM networking, and use-after-free bugs in WebAssembly and the JavaScript garbage collector. A use-after-free is a write to memory Thunderbird already freed. One About screen covers the set.

Mozilla also closed internally found memory corruption they say could be exploited with enough effort. Those sit in bucket CVEs. CVE-2026-74987 is the internal-bugs bucket for Thunderbird ESR 140.14, Thunderbird ESR 153.1, and Thunderbird 154. It is not the sandbox escape. The escape is 75874, and it lands on Thunderbird 154.

Mozilla has not said 75874 is being used in the wild. CISA has not added it to the Known Exploited Vulnerabilities catalog. The patch is out. That is the window.

Who is in range

You. Anyone still launching Thunderbird below 154 on Windows, Mac, or Linux.

Firefox 154 does not count. This tab is the mail client. Two installers. Two About screens. A shop PC with Thunderbird pinned as the company inbox is in range until About shows 154. If you “don’t use Thunderbird” but never uninstalled it, that copy is still in range.

ESR shops are on a slower train. Thunderbird 140.14 (MFSA 2026-79) and Thunderbird 153.1 (MFSA 2026-80) shipped the same day and took the internally found buckets, including 74987. They do not list 75874. Home readers on the release channel want Thunderbird 154. An ESR mailbox should take 140.14 or 153.1 for its train, not jump to 154 unless that is the plan.

What the vendor shipped

• Thunderbird 154 (18 August 2026), the build that closes 75874
• Thunderbird ESR 153.1, same day, internally found buckets, not the sandbox escape
• Thunderbird ESR 140.14, same day, same story
• Firefox 154 closed the same 75874 hole in the browser. That restart does not move Thunderbird

The card is MFSA 2026-78. The in-app path is Help, About Thunderbird. On a Mac it is Thunderbird, About Thunderbird. Thunderbird downloads the build itself. You wait, then Restart. A shop image frozen by policy will not self-update until whoever owns the image allows 154.

What this is not

• Not email remote code execution. Mozilla’s own caveat: scripting is off when you read mail.
• Not CVE-2026-74987. That number is an internal-bugs bucket. The sandbox escape is 75874.
• Not patched by updating Firefox. Same family, different installer.
• Not on CISA KEV. Mozilla has not said 75874 is in the wild.
• Not done if you downloaded 154 and never hit Restart.

The patch is out. About Thunderbird is already in Help. That is the cheap window.

Who can skip

• About Thunderbird already shows 154 or newer, and you have restarted once.
• ESR About already shows 153.1 or 140.14, and there is no release Thunderbird that anyone clicks.
• You confirmed Thunderbird is not installed. Outlook, Apple Mail, or webmail only.
• A shop PC whose Thunderbird is frozen by policy cannot self-update. That is an IT push of 154, or the matching ESR build, not a skip for the fleet.

Why it matters

Thunderbird holds the mail you already trust: invoices, password resets, the thread with the bank, the shop’s shared inbox. The sandbox is the fence that is supposed to keep untrusted code away from that pile. A sandbox escape in Remote Settings is how browser-like code inside Thunderbird stops being boxed and starts being the app. You do not need a second exploit story for that to be worth a restart.

Keep Mozilla’s caveat in your head. This is not “one phishing message owns the PC.” Scripting is off in the reading pane. The hole still exists, and Thunderbird still has browser-like surfaces. Mozilla rated 75874 high the same day they rated it high in Firefox. The installer is not shared.

Mozilla did not put an exploited flag on 75874. CISA has not added it to KEV. Waiting is still how a high bug sits on the inbox you click through every morning. The About window is already in the Help menu. The download is Mozilla’s own updater, not a third-party “mail client update” site.

The other machines are the easy miss. The laptop in the bag, the shop front-desk mailbox, the PC that “only checks mail”: each one is its own About screen. Updating Firefox does not move Thunderbird. Updating the desktop you are on does not move the copy in the other room. One stale copy is enough.

The bottom line

On the PC

1. Open Thunderbird. The inbox is fine. You do not need a special folder.
2. On Windows or Linux, click Help at the top, then About Thunderbird. On a Mac, click Thunderbird in the menu bar, then About Thunderbird. Some builds hide Help behind the hamburger button (three lines) in the top right.
3. A small About window opens. It will say Thunderbird and a version number, then start checking for updates.
4. Let it download. The line you want on the release channel is 154 or 154.0. If it still shows 153, stay on the window until 154 arrives.
5. Click Restart when the button appears. Thunderbird will close and reopen. That is expected. If there is no Restart button and the number is already 154, you are done on this PC.
6. Open About one more time after the restart and read the number. Do not trust the splash. Trust the About line.

If About Thunderbird never moves

Quit Thunderbird fully. On Windows, check the system tray and Task Manager for leftover Thunderbird processes, then reopen Thunderbird and try About again. A download that sits at 0% is often a proxy, a metered connection, or a shop policy. Use the network you already trust. Do not download Thunderbird from a random “mail update” site. Mozilla’s own About window is the installer. If you must fetch a package by hand, use Mozilla’s Thunderbird download page.

A shop PC with Thunderbird managed by Group Policy, an MDM catalog, or a “do not update” image will not self-update no matter how many times you open About. Ask whoever owns the image to push Thunderbird 154, or the matching ESR build if that is the train on the machine.

The other PC in the house

1. The laptop in the bag: same Help, About Thunderbird path tonight. Wait for 154, then Restart.
2. The shop front-desk mailbox and the machine that “only checks mail”: same clicks. One stale copy is enough.
3. ESR on that second machine: take 153.1 or 140.14 for its train. Do not jump an ESR shop to 154 unless that is the plan. 75874 is a Thunderbird 154 fix. The ESR builds still close the August bugs that land on those trains.
4. Firefox, if you also browse with it: Help, About Firefox, and take 154. That is a separate restart. It does not move this number.

What you should see

On the About window, under the Thunderbird heading, the version starts with 154. If you still see 153 or an older major, stay on the window. After Restart, the same About window should show 154 without asking again. ESR About will say 153.1 or 140.14. Do not type Firefox’s 154 into Thunderbird and call it done.

When you are done

Desktop About reads 154 or newer on release Thunderbird, or the August ESR build on an ESR machine. You have restarted once. Firefox, if you use it, is a separate 154. You do not need to rebuild the inbox, sign out of accounts, or clear local folders. You needed a new build. You have it.